I'm confused about Authenticated Roles in an Identity Pool when using Amplify for Auth.


I've built a simple React application that will make REST calls to an API Gateway which has a Resource Policy on it to control access. I've setup a User Pool, App Client and Identity Pool with Authenticated Roles that all match, but when running my application I'm confused about how and where I should be getting the roles from my Identity Pool and then how I should be passing them to the request to API Gateway.

I'm not sure exactly where to troubleshoot, but I do see that neither the idToken or accessToken in my signInUserSession contain any role information, so presumably the bearer token I'm sending in doesn't contain this information either.

Right now, all requests to API gateway result in 403 with the message 'User: anonymous is not authorized to perform: execute-api:Invoke on resource blabla'

My React App (simplified a bit):

import React, { useEffect } from 'react';
import { Amplify, Auth, API } from 'aws-amplify';
import { withAuthenticator } from '@aws-amplify/ui-react';
import '@aws-amplify/ui-react/styles.css';

const awsmobile = {
    "aws_project_region": "us-east-1",
    "aws_cognito_identity_pool_id": "us-east-1:bla-blabla-bla-blabla",
    "aws_cognito_region": "us-east-1",
    "aws_user_pools_id": "us-east-1_XXXXXXXXX",
    "aws_user_pools_web_client_id": "foostuffboostuff",
    "oauth": {
        "domain": "jefarr-test.auth.us-east-1.amazoncognito.com"
    "aws_cloud_logic_custom": [
             "name": "Cognito Test API",
             "endpoint": "https://foobar.execute-api.us-east-1.amazonaws.com/Test",
             "region": "us-east-1"


function App({ signOut, user }) {

    async function callApi() {
      const user = await Auth.currentAuthenticatedUser()
      const token = "Bearer: " + user.signInUserSession.idToken.jwtToken
      const apiName = 'Cognito Test API';
      const path = '/';
      const requestData = {
          headers: {
              Authorization: token
      const data = await API.get(apiName, path, requestData)
      console.log("data: ", data)
    return (
      <h1>Hello {user.username}</h1>
      <button onClick={signOut}>Sign out</button>
      <button onClick={callApi}>Call Api</button>
export default withAuthenticator(App);

How can I get these requests to API Gateway to work with the Resource Policy in place?

  • Been working on this all day and made exactly zero progress. I've tried sending the idToken and accessToken in via the Authorization header, and I've tried removing the headers from requestData, neither worked but when removing the custom headers I see the AWS4 signed Authorization header in the request which makes me think this is supposed to just work

    AWS4-HMAC-SHA256 Credential=XXXXXXXXXXXXXXX/20231103/us-east-1/execute-api/aws4_request, SignedHeaders=host;x-amz-date;x-amz-security-token, Signature=XXXXXXXXXXXXXXXXXXX
2 Answers

Get the user's credentials from Auth.currentCredentials() instead of Auth.currentAuthenticatedUser(). This will give you access to the identityId and userRole values from the identity pool.

profile pictureAWS
answered 8 months ago
  • Thank you, this is helpful in troubleshooting but not exactly what my problem was.

Accepted Answer

After another day or two of digging I found the problem. Under the "Method Request Settings" in API Gateway I needed to set "Authoriztion" to "AWS_IAM".


answered 7 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions